My server is under DDoS all weekend

Discussion in 'Bukkit Help' started by lucasdidur, Nov 24, 2012.

Thread Status:
Not open for further replies.
  1. Offline

    lucasdidur

    Hello everybody,

    I have suffered in recent months several DDoS attacks on my Minecraft server, they always happen throughout the weekend. And I have no idea who this behind it.

    It started in late October, an attack that was 300mbps, which occurred every 3 minutes. That was so encomodo that earlier this month I switched to a server in Limestone, yet the attacks keep happening, but now they are continuos. The filter stops the attacks, but not always manage to filter all.

    The attacks are of type TCP Syn flood with spoofed IP's.

    Anyone ever had a type of attack, or has? Had an idea of who could do this? I can not stand doing nothing, just getting the attacks. I need to do something to stop it.



    Information of the attacks:

    * Happen only on weekends.
    * Band of attack is usually 300mbps.
    * It's an attack type TCP Syn flood.
    * All ips are fake.


    Attack Images:
    Show Spoiler

    Old server:
    [​IMG]

    New Server:

    Last attack:
    [​IMG]

    Last 24h
    [​IMG]

    This month:
    [​IMG]

    My server:
    ..::| Eh Aqui |::.. #01 Survival - ip: mc.ehaqui.com
     
  2. Offline

    lokpique

    Contact your service provider and get police involved.
     
    tom1000o and Blackbirddddd like this.
  3. Offline

    lucasdidur

    I don't know if this is possible, since we have no idea who's doing the attacks, all connected ips are fakes.
     
  4. Offline

    Texton

    If your using a Linux OS, you could fashion some iptables rules to limit the number of connections per IP per minute.
     
  5. Offline

    lucasdidur

    This has already been done, thousands of ip per second, fake ips.
     
  6. Offline

    Milkywayz

    Most people who DDoS do it for a reason, I don't think they will just use their capabilities to take down a server for banning them when they clearly deserved what they did. It's usually the server's staff / owner doing something to them to provoke them. I've been ddos'd twice, both for the same reasoning mostly (Me being a jerk to someone before banning them for being a jerk to others, and griefing). Both times I knew the username of who did it, but their ip was not their real ip and the account was some random one they didn't buy. Basically if they can ddos 300mbs they will try pretty hard not to get caught...
     
  7. Offline

    lokpique

    Your service provider can. "Spoofing" is still very traceable, especially for your provider.
     
  8. Offline

    MysteryManX

    Yeah get in touch with the police or your ISP, what their doing is illegal, and they can get sent down for it
     
  9. Offline

    Gravity

    Eh. Police have much more important things to be dealing with (probably not, but either way they probably won't help you). I find that most people who DDoS pretty much want to get recognition for their petty attacks, so I would wait and try to get them to expose themselves, find their hosts and try to get 'em shut down. Probably a rival server/community. Not much you can do otherwise unless you're willing to invest.
     
    CeramicTitan likes this.
  10. Offline

    LaxWasHere

    Them kids and their 5 dollar booters. Been there, but in my case I know their username and I just firewall their IP so my server will always show as offline to them. Simple yet effective.
     
  11. Offline

    lucasdidur

    So, even though Spoofing, the IPS can trace the origin?

    About the police, the server is in another country and not where I live, I should contact my country or the country of the server?
     
  12. Offline

    LaxWasHere

    I doubt police will even care about your little server, if it's not causing you a huge amount of money they'll just "meh" you.
     
  13. Offline

    lucasdidur

    I think like you, police on my country does nothing.

    The host support said:
    This attack is not a packet-heavy attack. This is a connection-heavy attack, which is difficult to mitigate.
     
  14. Offline

    minecrafterwork I steal plugins as my own

    Well it's better to try and trace it as getting the police involved will not help if the attacker is another country because the police I don't think would bother tracking down a hacker in another country possibly far away just because he is ddosing a small Minecraft Server, so I think it is better to always try to trace the hacker first, or get clues to who might be doing it
     
  15. Offline

    MysteryManX

    I think you should give it a few days or a week, and see how things get on. If it keeps going on, THEN get in touch with your ISP/police.

    :)
     
  16. Offline

    lucasdidur

    I've contacted the ISP, and they said:

    My support said even if I have an 1Gbps port, will not stop the attack.

    EDIT by Moderator: merged posts, please use the edit button instead of double posting.
     
    Last edited by a moderator: May 30, 2016
  17. Offline

    Cirno

    If you use an actual server IP (e.g 0.0.0.0 for example), just get a new IP.
    However, if you don't, you can try using this: http://deflate.medialayer.com/
     
  18. Offline

    lucasdidur

    This will work only at small attacks not 400mpbs of syn flood.
     
  19. Offline

    lokpique

    Our police have a way to deal with these things. I guess you are assuming I was trying to say that they should send in the swat team or something... It's not about tracking down the bad guy, it's about getting the ISP off their ass and get them doing what they should be doing.

    Whenever I have had this problem on a server (ANY server) it has helped a lot to have the police contact the ISP as well about the situation. It gives the ISP the legal bounds, as well as motivation to actually deal with the issue... instead of handing it off to what is most likely a sister company to make even more money off of the user by having their traffic scrubbed.

    At least in my country this works. I have done this many times, and always had good results.
     
  20. Offline

    md_5

    I advise you to listen to this guy, he knows how to deal with these things :)
     
  21. Offline

    lucasdidur

    The attacks continue, and I decided I'll take the JavaPipe DDoS protection.

    They are monitoring us, because when attack the main IP, I change to a temporary, and tell on my forum, and a few minutes later, they switch the target for the new IP.

    I'm suspicious of Craftlandia, since my server is Brazilian, and they have jealous of the servers that are successful.
     
  22. Offline

    mgsolidus

  23. Offline

    lucasdidur

    I already have this firewall, but this will only work at small attacks, the server port is 100Mbps and attacks is about 400Mbps or more.
     
  24. Offline

    Symbiosis

    Try adding a login plugin to your server from bukkit. Some plugins could add protection to your server. Also, you mentioned the IP Addresses are fake. Try switching the online mode from false to true. Then people cannot randomly join the server with a pseudonym.

    I hope this post helped,

    Symbiosis :)
     
  25. Offline

    Gravity

    It's a ddos; an attack on their box's ports and stuff, not an attack on their minecraft server
    Nobody joins the server or even asks to join it, they just flood the box with syn packets that lead to nowhere.
     
  26. Offline

    lucasdidur

    This will work only at Boot Spam (I already have a plugin that blocks proxy), but not with a SYN Flood attack or a ICMP Flood (Ping of death) or even a UDP attack.
     
  27. Offline

    lucasdidur

    Now the attack has changed, is all time. And now is UDP flood at minecraft server port.



    Here status of this attack:

    - The server currently has a high network load. Possibly under attack.
    -- Reliability: 255/255
    -- Txload: 151/255
    -- Rxload: 9/255
    -- Inbound: 59500000 bits/sec, 115218 packets/sec

    -- Completed --


    Here some logs
    Show Spoiler

    21:55:02.344155 IP (tos 0x0, ttl 245, id 3576, offset 0, flags [none], proto: TCP (6), length: 40) 200.212.83.178.9857 > 69.162.72.226.25565: ., cksum 0x450e (correct), 2333649476:2333649476(0) ack 0 win 65535
    21:55:02.344163 IP (tos 0x0, ttl 245, id 8961, offset 0, flags [none], proto: TCP (6), length: 40) 200.201.63.175.6807 > 69.162.72.226.25565: ., cksum 0x2dab (correct), 3715665727:3715665727(0) ack 0 win 65535
    21:55:02.344176 IP (tos 0x0, ttl 245, id 8285, offset 0, flags [none], proto: TCP (6), length: 40) 200.253.185.61.29872 > 69.162.72.226.25565: ., cksum 0x195b (correct), 2545358197:2545358197(0) ack 0 win 65535
    21:55:02.344265 IP (tos 0x0, ttl 245, id 39537, offset 0, flags [none], proto: TCP (6), length: 40) 200.133.230.86.29436 > 69.162.72.226.25565: ., cksum 0xffa7 (correct), 343246717:343246717(0) ack 0 win 65535
    21:55:02.344549 IP (tos 0x0, ttl 244, id 38946, offset 0, flags [none], proto: TCP (6), length: 40) 112.179.212.8.55993 > 69.162.72.226.25565: S, cksum 0x139d (correct), 1191002993:1191002993(0) win 65535
    21:55:02.344706 IP (tos 0x0, ttl 244, id 25529, offset 0, flags [none], proto: TCP (6), length: 40) 85.21.48.58.52030 > 69.162.72.226.25565: S, cksum 0xb0a5 (correct), 2599952725:2599952725(0) win 65535
    21:55:02.344720 IP (tos 0x0, ttl 245, id 55926, offset 0, flags [none], proto: TCP (6), length: 40) 200.13.230.170.63402 > 69.162.72.226.25565: ., cksum 0x77bd (correct), 3054037321:3054037321(0) ack 0 win 65535
    21:55:02.344819 IP (tos 0x0, ttl 245, id 52610, offset 0, flags [none], proto: TCP (6), length: 40) 200.155.1.13.30338 > 69.162.72.226.25565: ., cksum 0x585e (correct), 767293230:767293230(0) ack 0 win 65535
    21:55:02.345051 IP (tos 0x0, ttl 244, id 41255, offset 0, flags [none], proto: TCP (6), length: 40) 31.39.106.100.38668 > 69.162.72.226.25565: S, cksum 0xf220 (correct), 779844685:779844685(0) win 65535
    21:55:02.345263 IP (tos 0x0, ttl 245, id 20508, offset 0, flags [none], proto: TCP (6), length: 40) 200.69.38.181.24538 > 69.162.72.226.25565: ., cksum 0x8350 (correct), 4228050762:4228050762(0) ack 0 win 65535
    21:55:02.345470 IP (tos 0x0, ttl 245, id 3290, offset 0, flags [none], proto: TCP (6), length: 40) 200.147.65.215.18348 > 69.162.72.226.25565: ., cksum 0x228b (correct), 3817366856:3817366856(0) ack 0 win 65535
    21:55:02.345478 IP (tos 0x0, ttl 245, id 62577, offset 0, flags [none], proto: TCP (6), length: 40) 200.26.123.91.22923 > 69.162.72.226.25565: ., cksum 0x1884 (correct), 1067567180:1067567180(0) ack 0 win 65535
    21:55:02.345574 IP (tos 0x0, ttl 244, id 22077, offset 0, flags [none], proto: TCP (6), length: 40) 65.223.186.39.5645 > 69.162.72.226.25565: S, cksum 0x9a37 (correct), 500167526:500167526(0) win 65535
    21:55:02.345807 IP (tos 0x0, ttl 244, id 15174, offset 0, flags [none], proto: TCP (6), length: 40) 99.54.9.38.13436 > 69.162.72.226.25565: S, cksum 0x1626 (correct), 1208663672:1208663672(0) win 65535
    21:55:02.345813 IP (tos 0x0, ttl 244, id 58704, offset 0, flags [none], proto: TCP (6), length: 40) 110.45.124.10.25962 > 69.162.72.226.25565: S, cksum 0xcc33 (correct), 1233934367:1233934367(0) win 65535
    21:55:02.345921 IP (tos 0x0, ttl 245, id 4425, offset 0, flags [none], proto: TCP (6), length: 40) 200.235.211.52.24081 > 69.162.72.226.25565: ., cksum 0x88ed (correct), 3456986182:3456986182(0) ack 0 win 65535
    21:55:02.346011 IP (tos 0x0, ttl 244, id 42493, offset 0, flags [none], proto: TCP (6), length: 40) 197.251.96.54.38199 > 69.162.72.226.25565: S, cksum 0xa982 (correct), 2839064412:2839064412(0) win 65535
    21:55:02.346017 IP (tos 0x0, ttl 244, id 42721, offset 0, flags [none], proto: TCP (6), length: 40) 112.93.126.117.49811 > 69.162.72.226.25565: S, cksum 0xc807 (correct), 2695668582:2695668582(0) win 65535
    21:55:02.346101 IP (tos 0x0, ttl 245, id 25735, offset 0, flags [none], proto: TCP (6), length: 40) 200.10.148.134.24578 > 69.162.72.226.25565: ., cksum 0x8a6f (correct), 3105537365:3105537365(0) ack 0 win 65535
    21:55:02.346113 IP (tos 0x0, ttl 245, id 22560, offset 0, flags [none], proto: TCP (6), length: 40) 200.21.155.73.52817 > 69.162.72.226.25565: ., cksum 0x9dd9 (correct), 4051434604:4051434604(0) ack 0 win 65535
    21:55:02.346226 IP (tos 0x0, ttl 245, id 27111, offset 0, flags [none], proto: TCP (6), length: 40) 200.164.88.234.46692 > 69.162.72.226.25565: ., cksum 0xaa3d (correct), 281356925:281356925(0) ack 0 win 65535
    21:55:02.346446 IP (tos 0x0, ttl 245, id 31477, offset 0, flags [none], proto: TCP (6), length: 40) 200.47.254.247.38779 > 69.162.72.226.25565: ., cksum 0xfc62 (correct), 250893177:250893177(0) ack 0 win 65535
    21:55:02.346458 IP (tos 0x0, ttl 245, id 5166, offset 0, flags [none], proto: TCP (6), length: 40) 200.163.208.28.vpnz > 69.162.72.226.25565: ., cksum 0x952a (correct), 3514939710:3514939710(0) ack 0 win 65535
    21:55:02.346659 IP (tos 0x0, ttl 245, id 41000, offset 0, flags [none], proto: TCP (6), length: 40) 200.223.253.15.robix > 69.162.72.226.25565: ., cksum 0xa4db (correct), 653919791:653919791(0) ack 0 win 65535
    21:55:02.346843 IP (tos 0x0, ttl 245, id 54115, offset 0, flags [none], proto: TCP (6), length: 40) 200.28.122.117.46893 > 69.162.72.226.25565: ., cksum 0x8737 (correct), 2975042344:2975042344(0) ack 0 win 65535
    21:55:02.346883 IP (tos 0x0, ttl 245, id 31234, offset 0, flags [none], proto: TCP (6), length: 40) 200.167.159.180.49906 > 69.162.72.226.25565: ., cksum 0x3220 (correct), 1640496700:1640496700(0) ack 0 win 65535
    21:55:02.346995 IP (tos 0x0, ttl 245, id 37335, offset 0, flags [none], proto: TCP (6), length: 40) 200.139.140.75.63692 > 69.162.72.226.25565: ., cksum 0x41fe (correct), 3513408614:3513408614(0) ack 0 win 65535
    21:55:02.347098 IP (tos 0x0, ttl 245, id 15082, offset 0, flags [none], proto: TCP (6), length: 40) 200.246.101.18.2195 > 69.162.72.226.25565: ., cksum 0xd1d1 (correct), 2611485021:2611485021(0) ack 0 win 65535
    21:55:02.347110 IP (tos 0x0, ttl 245, id 6303, offset 0, flags [none], proto: TCP (6), length: 40) 200.124.128.194.63841 > 69.162.72.226.25565: ., cksum 0x2a79 (correct), 2447949424:2447949424(0) ack 0 win 65535
    21:55:02.347203 IP (tos 0x0, ttl 244, id 32632, offset 0, flags [none], proto: TCP (6), length: 40) 92.218.242.45.bmc-perf-mgrd > 69.162.72.226.25565: S, cksum 0x7ff0 (correct), 2376550001:2376550001(0) win 65535
    21:55:02.347277 IP (tos 0x0, ttl 244, id 13794, offset 0, flags [none], proto: TCP (6), length: 40) 170.91.122.79.42667 > 69.162.72.226.25565: S, cksum 0x501f (correct), 805859843:805859843(0) win 65535
    21:55:02.347283 IP (tos 0x0, ttl 245, id 25130, offset 0, flags [none], proto: TCP (6), length: 40) 200.235.224.221.24995 > 69.162.72.226.25565: ., cksum 0x13da (correct), 4156139122:4156139122(0) ack 0 win 65535
    21:55:02.347486 IP (tos 0x0, ttl 245, id 51646, offset 0, flags [none], proto: TCP (6), length: 40) 200.84.159.129.61117 > 69.162.72.226.25565: ., cksum 0x1a05 (correct), 2661002814:2661002814(0) ack 0 win 65535
    21:55:02.347497 IP (tos 0x0, ttl 245, id 44401, offset 0, flags [none], proto: TCP (6), length: 40) 200.117.52.139.30742 > 69.162.72.226.25565: ., cksum 0x86b2 (correct), 3380410412:3380410412(0) ack 0 win 65535
    21:55:02.347501 IP (tos 0x0, ttl 245, id 2151, offset 0, flags [none], proto: TCP (6), length: 40) 200.119.78.149.6317 > 69.162.72.226.25565: ., cksum 0xe2c1 (correct), 1004760852:1004760852(0) ack 0 win 65535
    21:55:02.347573 IP (tos 0x0, ttl 244, id 62867, offset 0, flags [none], proto: TCP (6), length: 40) 85.170.160.53.40833 > 69.162.72.226.25565: S, cksum 0xfa6f (correct), 3327616856:3327616856(0) win 65535
    21:55:02.347921 IP (tos 0x0, ttl 245, id 57915, offset 0, flags [none], proto: TCP (6), length: 40) 200.85.97.199.56554 > 69.162.72.226.25565: ., cksum 0xe40e (correct), 405846572:405846572(0) ack 0 win 65535
    21:55:02.347931 IP (tos 0x0, ttl 245, id 32653, offset 0, flags [none], proto: TCP (6), length: 40) 200.162.122.79.5059 > 69.162.72.226.25565: ., cksum 0x2399 (correct), 3604376654:3604376654(0) ack 0 win 65535
    21:55:02.347938 IP (tos 0x0, ttl 244, id 886, offset 0, flags [none], proto: TCP (6), length: 40) 23.34.64.124.9040 > 69.162.72.226.25565: S, cksum 0xc0d7 (correct), 3498291511:3498291511(0) win 65535
    21:55:02.347948 IP (tos 0x0, ttl 245, id 9447, offset 0, flags [none], proto: TCP (6), length: 40) 200.65.157.44.39235 > 69.162.72.226.25565: ., cksum 0xf174 (correct), 1626434651:1626434651(0) ack 0 win 65535
    21:55:02.348095 IP (tos 0x0, ttl 245, id 23154, offset 0, flags [none], proto: TCP (6), length: 40) 200.230.73.173.33317 > 69.162.72.226.25565: ., cksum 0x831e (correct), 1247304515:1247304515(0) ack 0 win 65535
    21:55:02.348312 IP (tos 0x0, ttl 245, id 44636, offset 0, flags [none], proto: TCP (6), length: 40) 200.111.75.108.wherehoo > 69.162.72.226.25565: ., cksum 0xb53d (correct), 909158214:909158214(0) ack 0 win 65535
    21:55:02.348318 IP (tos 0x0, ttl 244, id 55781, offset 0, flags [none], proto: TCP (6), length: 40) 201.170.210.59.52075 > 69.162.72.226.25565: S, cksum 0x829c (correct), 1229752902:1229752902(0) win 65535
    21:55:02.348521 IP (tos 0x0, ttl 244, id 16775, offset 0, flags [none], proto: TCP (6), length: 40) 93.187.115.110.10513 > 69.162.72.226.25565: S, cksum 0x384c (correct), 3535714363:3535714363(0) win 65535
    21:55:02.348641 IP (tos 0x0, ttl 245, id 5250, offset 0, flags [none], proto: TCP (6), length: 40) 200.26.22.55.40579 > 69.162.72.226.25565: ., cksum 0xe683 (correct), 1660811036:1660811036(0) ack 0 win 65535
    21:55:02.348651 IP (tos 0x0, ttl 245, id 64285, offset 0, flags [none], proto: TCP (6), length: 40) 200.58.21.18.39955 > 69.162.72.226.25565: ., cksum 0x769f (correct), 4093237625:4093237625(0) ack 0 win 65535
    21:55:02.348730 IP (tos 0x0, ttl 244, id 41545, offset 0, flags [none], proto: TCP (6), length: 40) 137.6.244.112.15424 > 69.162.72.226.25565: S, cksum 0xd67c (correct), 3861858077:3861858077(0) win 65535
    21:55:02.348820 IP (tos 0x0, ttl 245, id 42081, offset 0, flags [none], proto: TCP (6), length: 40) 200.182.83.119.62424 > 69.162.72.226.25565: ., cksum 0x296a (correct), 1156005659:1156005659(0) ack 0 win 65535
    21:55:02.348826 IP (tos 0x0, ttl 245, id 18282, offset 0, flags [none], proto: TCP (6), length: 40) 200.185.170.162.11325 > 69.162.72.226.25565: ., cksum 0x2671 (correct), 642306336:642306336(0) ack 0 win 65535
    21:55:02.348832 IP (tos 0x0, ttl 245, id 50826, offset 0, flags [none], proto: TCP (6), length: 40) 200.62.39.222.13268 > 69.162.72.226.25565: ., cksum 0x9255 (correct), 1340258122:1340258122(0) ack 0 win 65535
    21:55:02.348902 IP (tos 0x0, ttl 244, id 62549, offset 0, flags [none], proto: TCP (6), length: 40) 37.139.60.21.28765 > 69.162.72.226.25565: S, cksum 0x93df (correct), 3595469141:3595469141(0) win 65535
    21:55:02.348988 IP (tos 0x0, ttl 244, id 40093, offset 0, flags [none], proto: TCP (6), length: 40) 202.210.236.64.824 > 69.162.72.226.25565: S, cksum 0x9c94 (correct), 663437078:663437078(0) win 65535
    21:55:02.349226 IP (tos 0x0, ttl 244, id 36615, offset 0, flags [none], proto: TCP (6), length: 40) 144.35.199.83.19419 > 69.162.72.226.25565: S, cksum 0xc881 (correct), 997725749:997725749(0) win 65535
    21:55:02.349239 IP (tos 0x0, ttl 245, id 8983, offset 0, flags [none], proto: TCP (6), length: 40) 200.70.62.239.60956 > 69.162.72.226.25565: ., cksum 0xf37d (correct), 2302233449:2302233449(0) ack 0 win 65535
    21:55:02.349381 IP (tos 0x0, ttl 245, id 11358, offset 0, flags [none], proto: TCP (6), length: 40) 200.216.102.79.33412 > 69.162.72.226.25565: ., cksum 0xdef7 (correct), 1909373696:1909373696(0) ack 0 win 65535
    21:55:02.349466 IP (tos 0x0, ttl 244, id 49935, offset 0, flags [none], proto: TCP (6), length: 40) 111.77.244.97.51456 > 69.162.72.226.25565: S, cksum 0xa9ab (correct), 1742241613:1742241613(0) win 65535
    21:55:02.349585 IP (tos 0x0, ttl 245, id 15401, offset 0, flags [none], proto: TCP (6), length: 40) 200.59.38.227.14591 > 69.162.72.226.25565: ., cksum 0xcca9 (correct), 4051425071:4051425071(0) ack 0 win 65535
    21:55:02.349805 IP (tos 0x0, ttl 244, id 51019, offset 0, flags [none], proto: TCP (6), length: 40) 91.108.168.66.47918 > 69.162.72.226.25565: S, cksum 0xe2f8 (correct), 660468813:660468813(0) win 65535
    21:55:02.349890 IP (tos 0x0, ttl 244, id 14302, offset 0, flags [none], proto: TCP (6), length: 40) 91.243.138.44.31442 > 69.162.72.226.25565: S, cksum 0x1ff6 (correct), 4133307963:4133307963(0) win 65535
    21:55:02.349968 IP (tos 0x0, ttl 244, id 48397, offset 0, flags [none], proto: TCP (6), length: 40) 64.18.175.94.directv-catlg > 69.162.72.226.25565: S, cksum 0xb294 (correct), 3978961224:3978961224(0) win 65535
    21:55:02.350053 IP (tos 0x0, ttl 244, id 19066, offset 0, flags [none], proto: TCP (6), length: 40) 87.93.249.53.11066 > 69.162.72.226.25565: S, cksum 0xaf13 (correct), 2302478691:2302478691(0) win 65535
    21:55:02.350072 IP (tos 0x0, ttl 244, id 63384, offset 0, flags [none], proto: TCP (6), length: 40) 33.60.187.124.apc-2260 > 69.162.72.226.25565: S, cksum 0x128e (correct), 1089897584:1089897584(0) win 65535
    21:55:02.350289 IP (tos 0x0, ttl 245, id 13390, offset 0, flags [none], proto: TCP (6), length: 40) 200.27.246.13.35766 > 69.162.72.226.25565: ., cksum 0xbd6f (correct), 1121874757:1121874757(0) ack 0 win 65535
    21:55:02.350337 IP (tos 0x0, ttl 245, id 12118, offset 0, flags [none], proto: TCP (6), length: 40) 200.89.31.240.33683 > 69.162.72.226.25565: ., cksum 0xa5d1 (correct), 3668693272:3668693272(0) ack 0 win 65535
    21:55:02.350412 IP (tos 0x0, ttl 245, id 59551, offset 0, flags [none], proto: TCP (6), length: 40) 200.166.194.141.62172 > 69.162.72.226.25565: ., cksum 0x58a6 (correct), 2408535852:2408535852(0) ack 0 win 65535
    21:55:02.350426 IP (tos 0x0, ttl 245, id 42461, offset 0, flags [none], proto: TCP (6), length: 40) 200.162.31.191.65286 > 69.162.72.226.25565: ., cksum 0xd3f5 (correct), 2529192788:2529192788(0) ack 0 win 65535
    21:55:02.350507 IP (tos 0x0, ttl 245, id 40752, offset 0, flags [none], proto: TCP (6), length: 40) 200.227.31.130.46126 > 69.162.72.226.25565: ., cksum 0x96b3 (correct), 2898124141:2898124141(0) ack 0 win 65535
    21:55:02.350583 IP (tos 0x0, ttl 244, id 33795, offset 0, flags [none], proto: TCP (6), length: 40) 39.195.149.17.plysrv-https > 69.162.72.226.25565: S, cksum 0x032c (correct), 3046649205:3046649205(0) win 65535
    21:55:02.350668 IP (tos 0x0, ttl 244, id 15152, offset 0, flags [none], proto: TCP (6), length: 40) 214.124.238.73.5113 > 69.162.72.226.25565: S, cksum 0xd63d (correct), 824827226:824827226(0) win 65535



    I will order a DDoS protection by JavaPipe, is the cheapest that I have found.
     
Thread Status:
Not open for further replies.

Share This Page